From 1039bffd6ae9c75b42b7d148d6c1106134107b66 Mon Sep 17 00:00:00 2001 From: Xie Yuanbin Date: Tue, 28 Jul 2026 03:16:42 +0100 Subject: ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, a user fault may trigger show_pte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while show_pte() is still traversing them, causing a use-after-free in show_pte(). If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table of PMD are freed when show_pte() is running. Acquire mmap_write_lock() around show_pte() for user faults to fix the contention. For user faults, additionally restrict that show_pte() is called only when the addr is a user-space address (addr < TASK_SIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications. Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock. Co-developed-by: Qi Xi Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults") Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com Acked-by: Lorenzo Stoakes (ARM) Reviewed-by: Linus Walleij Signed-off-by: Qi Xi Signed-off-by: Xie Yuanbin Signed-off-by: Russell King --- tools/perf/tests/thread-map.c | 151 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) create mode 100644 tools/perf/tests/thread-map.c (limited to 'tools/perf/tests/thread-map.c') diff --git a/tools/perf/tests/thread-map.c b/tools/perf/tests/thread-map.c new file mode 100644 index 000000000..877868107 --- /dev/null +++ b/tools/perf/tests/thread-map.c @@ -0,0 +1,151 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include +#include +#include +#include "tests.h" +#include "thread_map.h" +#include "debug.h" +#include "event.h" +#include "util/synthetic-events.h" +#include +#include + +struct perf_sample; +struct perf_tool; +struct machine; + +#define NAME (const char *) "perf" +#define NAMEUL (unsigned long) NAME + +static int test__thread_map(struct test_suite *test __maybe_unused, int subtest __maybe_unused) +{ + struct perf_thread_map *map; + + TEST_ASSERT_VAL("failed to set process name", + !prctl(PR_SET_NAME, NAMEUL, 0, 0, 0)); + + /* test map on current pid */ + map = thread_map__new_by_pid(getpid()); + TEST_ASSERT_VAL("failed to alloc map", map); + + thread_map__read_comms(map); + + TEST_ASSERT_VAL("wrong nr", map->nr == 1); + TEST_ASSERT_VAL("wrong pid", + perf_thread_map__pid(map, 0) == getpid()); + TEST_ASSERT_VAL("wrong comm", + perf_thread_map__comm(map, 0) && + !strcmp(perf_thread_map__comm(map, 0), NAME)); + TEST_ASSERT_VAL("wrong refcnt", + refcount_read(&map->refcnt) == 1); + perf_thread_map__put(map); + + /* test dummy pid */ + map = perf_thread_map__new_dummy(); + TEST_ASSERT_VAL("failed to alloc map", map); + + thread_map__read_comms(map); + + TEST_ASSERT_VAL("wrong nr", map->nr == 1); + TEST_ASSERT_VAL("wrong pid", perf_thread_map__pid(map, 0) == -1); + TEST_ASSERT_VAL("wrong comm", + perf_thread_map__comm(map, 0) && + !strcmp(perf_thread_map__comm(map, 0), "dummy")); + TEST_ASSERT_VAL("wrong refcnt", + refcount_read(&map->refcnt) == 1); + perf_thread_map__put(map); + return 0; +} + +static int process_event(const struct perf_tool *tool __maybe_unused, + union perf_event *event, + struct perf_sample *sample __maybe_unused, + struct machine *machine __maybe_unused) +{ + struct perf_record_thread_map *map = &event->thread_map; + struct perf_thread_map *threads; + + TEST_ASSERT_VAL("wrong nr", map->nr == 1); + TEST_ASSERT_VAL("wrong pid", map->entries[0].pid == (u64) getpid()); + TEST_ASSERT_VAL("wrong comm", !strcmp(map->entries[0].comm, NAME)); + + threads = thread_map__new_event(&event->thread_map); + TEST_ASSERT_VAL("failed to alloc map", threads); + + TEST_ASSERT_VAL("wrong nr", threads->nr == 1); + TEST_ASSERT_VAL("wrong pid", + perf_thread_map__pid(threads, 0) == getpid()); + TEST_ASSERT_VAL("wrong comm", + perf_thread_map__comm(threads, 0) && + !strcmp(perf_thread_map__comm(threads, 0), NAME)); + TEST_ASSERT_VAL("wrong refcnt", + refcount_read(&threads->refcnt) == 1); + perf_thread_map__put(threads); + return 0; +} + +static int test__thread_map_synthesize(struct test_suite *test __maybe_unused, int subtest __maybe_unused) +{ + struct perf_thread_map *threads; + + TEST_ASSERT_VAL("failed to set process name", + !prctl(PR_SET_NAME, NAMEUL, 0, 0, 0)); + + /* test map on current pid */ + threads = thread_map__new_by_pid(getpid()); + TEST_ASSERT_VAL("failed to alloc map", threads); + + thread_map__read_comms(threads); + + TEST_ASSERT_VAL("failed to synthesize map", + !perf_event__synthesize_thread_map2(NULL, threads, process_event, NULL)); + + perf_thread_map__put(threads); + return 0; +} + +static int test__thread_map_remove(struct test_suite *test __maybe_unused, int subtest __maybe_unused) +{ + struct perf_thread_map *threads; + char *str; + + TEST_ASSERT_VAL("failed to allocate map string", + asprintf(&str, "%d,%d", getpid(), getppid()) >= 0); + + threads = thread_map__new_str(str, /*tid=*/NULL, /*all_threads=*/false); + free(str); + + TEST_ASSERT_VAL("failed to allocate thread_map", + threads); + + if (verbose > 0) + thread_map__fprintf(threads, stderr); + + TEST_ASSERT_VAL("failed to remove thread", + !thread_map__remove(threads, 0)); + + TEST_ASSERT_VAL("thread_map count != 1", threads->nr == 1); + + if (verbose > 0) + thread_map__fprintf(threads, stderr); + + TEST_ASSERT_VAL("failed to remove thread", + !thread_map__remove(threads, 0)); + + TEST_ASSERT_VAL("thread_map count != 0", threads->nr == 0); + + if (verbose > 0) + thread_map__fprintf(threads, stderr); + + TEST_ASSERT_VAL("failed to not remove thread", + thread_map__remove(threads, 0)); + + perf_thread_map__put(threads); + return 0; +} + +DEFINE_SUITE("Thread map", thread_map); +DEFINE_SUITE("Synthesize thread map", thread_map_synthesize); +DEFINE_SUITE("Remove thread map", thread_map_remove); -- cgit v1.3.1